| From 04c52433c61112e629391115384cd317b582e55a Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Thu, 23 Mar 2017 13:40:00 +0300 |
| Subject: [PATCH] iwlwifi: mvm: writing zero bytes to debugfs causes a crash |
| |
| commit 251fe09f13bfb54c1ede66ee8bf8ddd0061c4f7c upstream. |
| |
| This is a static analysis fix. The warning is: |
| |
| drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect() |
| warn: integer overflows 'sizeof(*desc) + len' |
| |
| I guess this code is supposed to take a NUL character, but if we write |
| zero bytes then it tries to write -1 characters and crashes. |
| |
| Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Luca Coelho <luciano.coelho@intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c |
| index b34489817c70..d4f1843f258f 100644 |
| --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c |
| +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c |
| @@ -1003,6 +1003,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm, |
| |
| if (ret) |
| return ret; |
| + if (count == 0) |
| + return 0; |
| |
| iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf, |
| (count - 1), NULL); |
| -- |
| 2.12.0 |
| |
